A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties, commonly used for authentication and API authorization.

Does decoding verify the signature?

No, this tool simply base64-decodes the payload for inspection. To verify authenticity, the server must validate the signature against its secret key.

Can anyone read my JWT?

Yes! By design, the header and payload of a standard JWT are just base64 encoded, not encrypted. Never store sensitive data like passwords inside a JWT payload.

JWT Inspector

Decode and inspect JSON Web Tokens (JWT). Paste your token below to view the decoded header and payload. (Note: Signature is not verified).

Header ALGORITHM & TOKEN TYPE

Payload DATA

What is the JWT Inspector?

The JWT Inspector decodes JSON Web Tokens to reveal their underlying Header and Payload data structures, allowing developers to inspect claims and expiration times.

How to use it

Paste your base64-encoded JWT string into the input area.
Click "Decode JWT".
Review the formatted JSON output for the header and payload.

JWT Inspector

What is the JWT Inspector?

How to use it

Frequently Asked Questions